pentect 0.0.33 → 0.0.34

package/README.md

@@ -1,6 +1,6 @@
 <p align="center">
   <a href="https://pentect.dev/">
-    <img src="website/public/pentect-logo-transparent.png" width="96" alt="Pentect">
+    <img src="https://pentect.dev/pentect-logo-transparent.png" width="96" alt="Pentect">
   </a>
 </p>
 
@@ -31,6 +31,11 @@ providers. Start with the [documentation](https://pentect.dev/).
 - [Contributing](CONTRIBUTING.md)
 - [Third-party notices](THIRD_PARTY_LICENSES.txt)
 
+> **Security scope:** Pentect does not protect a compromised operating system
+> from malware with administrator privileges or an attacker that can read local
+> process memory. It reduces unintended disclosure of sensitive data to AI
+> providers.
+
 ## License
 
 [MIT](LICENSE)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pentect",
-  "version": "0.0.33",
+  "version": "0.0.34",
   "type": "module",
   "description": "Local secret masking boundary for AI agents",
   "license": "MIT",
@@ -20,7 +20,6 @@
     "README.md"
   ],
   "scripts": {
-    "postinstall": "node packaging/npm/install.js",
     "test": "node --test packaging/npm/*.test.js"
   },
   "engines": {

package/packaging/npm/bin/pentect.js

@@ -1,8 +1,15 @@
 #!/usr/bin/env node
 import { spawnSync } from 'node:child_process';
-import { fileURLToPath } from 'node:url';
+import { ensureInstalled } from '../install.js';
+
+let executable;
+try {
+  executable = await ensureInstalled();
+} catch (error) {
+  console.error(`pentect: ${error.message}`);
+  process.exit(1);
+}
 
-const executable = fileURLToPath(new URL(`../vendor/${process.platform === 'win32' ? 'pentect.exe' : 'pentect'}`, import.meta.url));
 const result = spawnSync(executable, process.argv.slice(2), { stdio: 'inherit' });
 if (result.error) {
   console.error(`pentect: ${result.error.message}`);

package/packaging/npm/install.js

@@ -1,12 +1,30 @@
 import { createHash } from 'node:crypto';
-import { chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { access, chmod, mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { homedir } from 'node:os';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { gunzipSync } from 'node:zlib';
 
 const repository = 'EdamAme-x/pentect';
 const packageRoot = fileURLToPath(new URL('../..', import.meta.url));
-const destination = join(packageRoot, 'packaging', 'npm', 'vendor', process.platform === 'win32' ? 'pentect.exe' : 'pentect');
+
+function cacheBase(environment = process.env, platform = process.platform, home = homedir()) {
+  if (environment.PENTECT_NPM_CACHE) return resolve(environment.PENTECT_NPM_CACHE);
+  if (platform === 'win32') {
+    return resolve(environment.LOCALAPPDATA || join(home, 'AppData', 'Local'), 'Pentect', 'npm');
+  }
+  if (platform === 'darwin') return resolve(home, 'Library', 'Caches', 'Pentect', 'npm');
+  return resolve(environment.XDG_CACHE_HOME || join(home, '.cache'), 'pentect', 'npm');
+}
+
+export function installationPath(version, options = {}) {
+  if (!/^[0-9A-Za-z][0-9A-Za-z._+-]{0,63}$/.test(version) || version === '..') {
+    throw new Error('The Pentect package version is invalid');
+  }
+  const platform = options.platform || process.platform;
+  const base = cacheBase(options.environment, platform, options.home);
+  return join(base, version, platform === 'win32' ? 'pentect.exe' : 'pentect');
+}
 
 export function releaseAsset(platform = process.platform, architecture = process.arch) {
   const assets = {
@@ -27,6 +45,11 @@ export function expectedChecksum(text) {
   return match[1].toLowerCase();
 }
 
+async function packageVersion() {
+  const metadata = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'));
+  return metadata.version?.replace(/^v/, '');
+}
+
 async function download(url, signal) {
   const response = await fetch(url, {
     redirect: 'follow',
@@ -50,10 +73,10 @@ async function downloadBinary(base, asset, signal) {
   return download(`${base}/${asset}`, signal);
 }
 
-export async function install() {
+export async function install(version) {
+  version ||= await packageVersion();
   const asset = releaseAsset();
-  const metadata = JSON.parse(await readFile(join(packageRoot, 'package.json'), 'utf8'));
-  const version = (process.env.PENTECT_VERSION || metadata.version)?.replace(/^v/, '');
+  const destination = installationPath(version);
   const tag = version ? `v${version}` : 'latest';
   const base = tag === 'latest'
     ? `https://github.com/${repository}/releases/latest/download`
@@ -74,9 +97,28 @@ export async function install() {
     await rm(destination, { force: true });
     await rename(temporary, destination);
     if (process.platform !== 'win32') await chmod(destination, 0o755);
+    await writeFile(join(dirname(destination), '.pentect-managed-install.json'), JSON.stringify({
+      version: 1,
+      manager: 'npm',
+      update: 'npm update -g pentect',
+      uninstall: 'npm uninstall -g pentect',
+    }), { mode: 0o600 });
   } finally {
     await rm(temporary, { force: true });
   }
+  return destination;
+}
+
+export async function ensureInstalled() {
+  const version = await packageVersion();
+  const destination = installationPath(version);
+  try {
+    await access(destination);
+    return destination;
+  } catch (error) {
+    if (error?.code !== 'ENOENT') throw error;
+  }
+  return install(version);
 }
 
 const invokedDirectly = process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1]);